Add doc on new field `request.kubernetes_resources` #48480

kimlisa · 2024-11-05T21:42:15Z

vercel link to new section:
https://docs-bgpfzlzb8-goteleport.vercel.app/docs/admin-guides/access-controls/access-requests/resource-requests/#restrict-access-requests-to-specific-kubernetes-resources

new role spec link:
https://docs-gtbutz7i0-goteleport.vercel.app/docs/reference/access-controls/roles/#example-role-specification

github-actions · 2024-11-05T21:53:17Z

🤖 Vercel preview here: https://docs-gtbutz7i0-goteleport.vercel.app/docs/ver/preview

r0mant · 2024-11-05T22:16:58Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+        - "kube-access"
+      kubernetes_resources:
+        - kind: "namespace"
+  deny: {}


Suggested change

deny: {}

r0mant · 2024-11-05T22:17:05Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+      kubernetes_resources:
+        - kind: "namespace"
+        - kind: "pod"
+  deny: {}


Suggested change

deny: {}

r0mant · 2024-11-05T22:17:11Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+        - "kube-access"
+      kubernetes_resources:
+        - kind: "*"
+  deny: {}


Suggested change

deny: {}

r0mant · 2024-11-05T22:17:54Z

docs/pages/includes/role-spec.mdx

+      # 'kubernetes_resources' restricts what kinds of Kubernetes resources
+      # a user can access request to. The example defined below, enforces users to 
+      # request only Kubernetes namespaces. Default (when nothing is defined) allows
+      # any Kubernetes resource request.


Suggested change

# any Kubernetes resource request.

# access requests to any Kubernetes resource or the entire cluster.

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

nklaassen · 2024-11-05T22:16:19Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

@@ -406,6 +406,72 @@ Requesting access to a Kubernetes Namespace allows you to access all resources
 in that namespace but you won't be able to access any other supported resources
 in the cluster.

+##### Enforce users to request only allowed Kubernetes Resources


how does this feature interact with the previous paragraph, should it be edited at all?

it starts from here https://docs-bgpfzlzb8-goteleport.vercel.app/docs/admin-guides/access-controls/access-requests/resource-requests/#restrict-access-requests-to-specific-kubernetes-resources

and content organization is like:

> Restrict the resources a user can request access to > kube_cluster > Kubernetes resources > Preventing unintended access to Kubernetes resources > Restrict Access Requests to specific Kubernetes resources

nklaassen · 2024-11-05T22:16:42Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+The following role assigned to a user, restricts access requesting to only Kubernetes namespaces.
+If a user attempts to make a request to Kubernetes resources other than `namespace` then the request
+will be rejected:


What does requesting access to a namespace even mean? Do you get access to anything within that namespace? Could we either explain that or use a simpler kind for this example like pod or something?

i would like to keep it as namespace example as we think that'll be the most often used value

the section above this section explains restricting Kubernetes access.

i added this to the bottom of my section:

The `request.kubernetes_resources` field only restricts what `kinds` of Kubernetes resource requests are allowed. To control Kubernetes access to these resources see [Preventing unintended access to Kubernetes resources](#thehash) section for more details.

does that help?

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

nklaassen · 2024-11-05T22:22:25Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+The following role assigned to a user, restricts users from access requesting to a Kubernetes cluster but
+allows requesting to any Kubernetes resources:


Suggested change

The following role assigned to a user, restricts users from access requesting to a Kubernetes cluster but

allows requesting to any Kubernetes resources:

The following role, when assigned to a user, allows them to request access to any specific

Kubernetes resource, but does *not* allow requesting access to the entire cluster.

i removed the mention of not allowing requesting access to the entire cluster here, and moved it towards the beginning of the section, see comment: https://github.com/gravitational/teleport/pull/48480/files#r1830229498

btw, you and zac both gave review around same time i think, i took some of zac's suggestion over yours (or tried to combine the best parts)

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

docs/pages/includes/role-spec.mdx

zmb3 · 2024-11-05T22:21:50Z

docs/pages/includes/role-spec.mdx

@@ -350,6 +350,13 @@ spec:
      # resources accessible by the listed roles (enterprise-only)
      search_as_roles: ['access']

+      # 'kubernetes_resources' restricts what kinds of Kubernetes resources
+      # a user can access request to. The example defined below, enforces users to 


Suggested change

# a user can access request to. The example defined below, enforces users to

# a user can request access to. In the below example, users can

zmb3 · 2024-11-05T22:22:24Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+  deny: {}
+```
+
+By default, when `request.kubernetes_resources` field is not configured, there are no enforcements and


Suggested change

By default, when `request.kubernetes_resources` field is not configured, there are no enforcements and

If the `request.kubernetes_resources` field is not configured, then

zmb3 · 2024-11-05T22:22:54Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+a user can make request to any Kubernetes resources including its cluster.
+
+See related section about [Kubernetes Resources](../../../../enroll-resources/kubernetes-access/controls.mdx/#kubernetes_resources) 
+to see a list of supported `kind`. Note that only the `kind` field is supported.


Suggested change

to see a list of supported `kind`. Note that only the `kind` field is supported.

to see a list of supported `kind` values.

zmb3 · 2024-11-05T22:24:45Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+The following role assigned to a user, restricts users from access requesting to a Kubernetes cluster but
+allows requesting to any Kubernetes resources:


Suggested change

The following role assigned to a user, restricts users from access requesting to a Kubernetes cluster but

allows requesting to any Kubernetes resources:

The following role restricts users from requesting access to a Kubernetes cluster but

allows requesting to any Kubernetes resources:

Remove "assigned to a user." The sentence reads just as well without it.

"Access requesting" is not a verb. Let's say "requesting access" instead.

I don't quite understand the example - how does it restrict users from requesting access to kube clusters?

i removed the restricting users from requesting access to kube cluster phrase from this example. instead i moved it to the beginning of section like this:

The `request.kubernetes_resources` field allows you to restrict what kinds of Kubernetes resources a user can request access to. Configuring this field to any value will disallow requesting access to the entire Kubernetes cluster. If the `request.kubernetes_resources` field is not configured, then a user can request access to any Kubernetes resources, including the entire Kubernetes cluster. <... insert exmaples>

does this make more sense?

zmb3 · 2024-11-05T22:25:20Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+  deny: {}
+```
+
+The following role assigned to a user, restricts access requesting to only Kubernetes namespaces and/or pods.


Suggested change

The following role assigned to a user, restricts access requesting to only Kubernetes namespaces and/or pods.

The following role allows users to request access only to Kubernetes namespaces and/or pods.

zmb3 · 2024-11-05T22:25:58Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+The `request.kubernetes_resources` field allows you to restrict what kinds of Kubernetes 
+resources a user can access request to.
+
+The following role assigned to a user, restricts access requesting to only Kubernetes namespaces.


Suggested change

The following role assigned to a user, restricts access requesting to only Kubernetes namespaces.

The following role allows users to request access to Kubernetes namespaces.

zmb3 · 2024-11-05T22:26:09Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

+##### Enforce users to request only allowed Kubernetes Resources
+
+The `request.kubernetes_resources` field allows you to restrict what kinds of Kubernetes 
+resources a user can access request to.


Suggested change

resources a user can access request to.

resources a user can request access to.

zmb3 · 2024-11-05T22:26:32Z

docs/pages/admin-guides/access-controls/access-requests/resource-requests.mdx

@@ -406,6 +406,72 @@ Requesting access to a Kubernetes Namespace allows you to access all resources
 in that namespace but you won't be able to access any other supported resources
 in the cluster.

+##### Enforce users to request only allowed Kubernetes Resources


Suggested change

##### Enforce users to request only allowed Kubernetes Resources

##### Restrict Access Requests to specific Kubernetes resources

github-actions · 2024-11-06T00:26:40Z

🤖 Vercel preview here: https://docs-bgpfzlzb8-goteleport.vercel.app/docs/ver/preview

github-actions · 2024-11-07T23:59:18Z

🤖 Vercel preview here: https://docs-lahad8tpw-goteleport.vercel.app/docs/ver/preview

github-actions · 2024-11-08T00:59:03Z

🤖 Vercel preview here: https://docs-n5ovm722g-goteleport.vercel.app/docs/ver/preview

github-actions · 2024-11-08T02:17:42Z

🤖 Vercel preview here: https://docs-8ijud65tx-goteleport.vercel.app/docs/ver/preview

public-teleport-github-review-bot · 2024-11-08T02:52:11Z

@kimlisa See the table below for backport results.

Branch	Result
branch/v16	Create PR
branch/v17	Create PR

kimlisa temporarily deployed to vercel November 5, 2024 21:42 — with GitHub Actions Inactive

github-actions bot requested review from mmcallister, nklaassen, ptgott, r0mant, xinding33 and zmb3 November 5, 2024 21:42

github-actions bot added documentation size/sm labels Nov 5, 2024

kimlisa added backport/branch/v16 backport/branch/v17 no-changelog Indicates that a PR does not require a changelog entry labels Nov 5, 2024

r0mant approved these changes Nov 5, 2024

View reviewed changes

nklaassen reviewed Nov 5, 2024

View reviewed changes

zmb3 reviewed Nov 5, 2024

View reviewed changes

kimlisa temporarily deployed to vercel November 6, 2024 00:15 — with GitHub Actions Inactive

kimlisa requested review from zmb3 and nklaassen November 6, 2024 00:33

zmb3 approved these changes Nov 6, 2024

View reviewed changes

public-teleport-github-review-bot bot removed request for mmcallister, xinding33 and ptgott November 6, 2024 17:59

nklaassen approved these changes Nov 7, 2024

View reviewed changes

kimlisa enabled auto-merge November 7, 2024 21:43

kimlisa added 2 commits November 7, 2024 15:48

Add doc on new field

298ed9e

Address reviews

8f0c15d

kimlisa force-pushed the lisa/update-doc branch from a21d409 to 42d36e3 Compare November 7, 2024 23:48

kimlisa temporarily deployed to vercel November 7, 2024 23:48 — with GitHub Actions Inactive

kimlisa disabled auto-merge November 7, 2024 23:49

kimlisa force-pushed the lisa/update-doc branch from 42d36e3 to 17b27b9 Compare November 8, 2024 00:48

kimlisa temporarily deployed to vercel November 8, 2024 00:48 — with GitHub Actions Inactive

fix lint

447d6c8

kimlisa force-pushed the lisa/update-doc branch from 17b27b9 to 447d6c8 Compare November 8, 2024 02:06

kimlisa temporarily deployed to vercel November 8, 2024 02:07 — with GitHub Actions Inactive

kimlisa added this pull request to the merge queue Nov 8, 2024

Merged via the queue into master with commit 4276616 Nov 8, 2024
40 checks passed

kimlisa deleted the lisa/update-doc branch November 8, 2024 02:50

This was referenced Nov 8, 2024

[v17] Add doc on new field request.kubernetes_resources #48653

Merged

[v16] Add doc on new field request.kubernetes_resources #48654

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add doc on new field `request.kubernetes_resources` #48480

Add doc on new field `request.kubernetes_resources` #48480

kimlisa commented Nov 5, 2024 •

edited

Loading

github-actions bot commented Nov 5, 2024

r0mant Nov 5, 2024

r0mant Nov 5, 2024

r0mant Nov 5, 2024

r0mant Nov 5, 2024

nklaassen Nov 5, 2024

kimlisa Nov 5, 2024 •

edited

Loading

nklaassen Nov 5, 2024

kimlisa Nov 6, 2024 •

edited

Loading

nklaassen Nov 5, 2024

kimlisa Nov 6, 2024 •

edited

Loading

kimlisa Nov 6, 2024

zmb3 Nov 5, 2024

zmb3 Nov 5, 2024

zmb3 Nov 5, 2024

zmb3 Nov 5, 2024

kimlisa Nov 6, 2024 •

edited

Loading

zmb3 Nov 6, 2024

zmb3 Nov 5, 2024

zmb3 Nov 5, 2024

zmb3 Nov 5, 2024

zmb3 Nov 5, 2024

github-actions bot commented Nov 6, 2024

github-actions bot commented Nov 7, 2024

github-actions bot commented Nov 8, 2024

github-actions bot commented Nov 8, 2024

public-teleport-github-review-bot bot commented Nov 8, 2024

	# any Kubernetes resource request.
	# access requests to any Kubernetes resource or the entire cluster.

		The following role assigned to a user, restricts users from access requesting to a Kubernetes cluster but
		allows requesting to any Kubernetes resources:

	# a user can access request to. The example defined below, enforces users to
	# a user can request access to. In the below example, users can

	By default, when `request.kubernetes_resources` field is not configured, there are no enforcements and
	If the `request.kubernetes_resources` field is not configured, then

	to see a list of supported `kind`. Note that only the `kind` field is supported.
	to see a list of supported `kind` values.

	The following role assigned to a user, restricts access requesting to only Kubernetes namespaces and/or pods.
	The following role allows users to request access only to Kubernetes namespaces and/or pods.

	resources a user can access request to.
	resources a user can request access to.

	##### Enforce users to request only allowed Kubernetes Resources
	##### Restrict Access Requests to specific Kubernetes resources

Add doc on new field request.kubernetes_resources #48480

Add doc on new field request.kubernetes_resources #48480

Conversation

kimlisa commented Nov 5, 2024 • edited Loading

github-actions bot commented Nov 5, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kimlisa Nov 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kimlisa Nov 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kimlisa Nov 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

kimlisa Nov 6, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Nov 6, 2024

github-actions bot commented Nov 7, 2024

github-actions bot commented Nov 8, 2024

github-actions bot commented Nov 8, 2024

public-teleport-github-review-bot bot commented Nov 8, 2024

Add doc on new field `request.kubernetes_resources` #48480

Add doc on new field `request.kubernetes_resources` #48480

kimlisa commented Nov 5, 2024 •

edited

Loading

kimlisa Nov 5, 2024 •

edited

Loading

kimlisa Nov 6, 2024 •

edited

Loading

kimlisa Nov 6, 2024 •

edited

Loading

kimlisa Nov 6, 2024 •

edited

Loading